After the session: the traces an 18+ chatroulette leaves on your device

A conversation ends when you click "leave". The device, on the other hand, ends nothing. It has written an address into the history, saved files to a cache, set cookies, memorised a login in a password manager, placed a thumbnail in the list of recently closed tabs and, sometimes, displayed a notification on the lock screen. All of that survives the session, and that is usually where — on the living-room computer, not on the internet — an adult's privacy is lost.

Most precautions taken on adults-only video chat concern what the other person sees: the background, the lighting, the sound. This one concerns what your own household sees afterwards. A partner typing a single letter into the address bar, a flatmate borrowing the laptop to print a train ticket, a colleague glancing over your shoulder while the browser offers its suggestions: these are the real, mundane scenarios, with no hacker involved.

Seven distinct traces, seven different lifespans

People commonly talk about "the history" as if it were a single list to empty. In practice, an 18+ chatroulette session leaves behind at least seven types of information, in seven different places, with erasure rules that have nothing in common.

The most underestimated row is the second one. Even after deleting a specific page from the history, browsers often keep a frequency score per domain: typing a single letter is then enough to bring up a suggestion in front of a witness. That is the mechanism that betrays the most adults, well before the cache or the cookies.

The special case of cookies

The cookies set by an 18+ platform almost never contain intimate information: they are session tokens and preferences. Their problem is not their content, it is their name, visible in plain text in the browser settings, along with the domain.

In its guidelines, the CNIL (French data protection authority) points out that the retention period for audience-measurement cookies should not exceed thirteen months, and that consent must be as easy to withdraw as it was to give. In plain terms: a banner that offers no way to refuse is non-compliant, and an adult always has the right to delete these trackers without losing access to the service.

Private browsing: what it does, what it does not do

The private browsing (or "incognito") window is the most effective tool of the lot, and the most misunderstood. It acts on one level only: the browser's local storage.

What it genuinely prevents:

• writing to the browsing history;
• keeping cookies and local storage after the window closes;
• saving form data and passwords;
• feeding the address bar's frequency score.

What it does not change in the slightest:

• what your internet provider and the local network see — a topic covered in detail in our article on what your operator and your router see of your sessions;
• records held on the platform's side (account, moderation logs, billing);
• files you deliberately download;
• camera and microphone permissions already granted at system level;
• the browser's presence in the list of recent apps.

One point that is rarely mentioned: in private browsing, most browsers no longer grant permanent camera permission. Authorisation is requested for each session and disappears when the window closes. That is a real advantage for permission hygiene, detailed in our inventory of who can switch on your camera.

Private browsing protects you from the people around you, not from the rest of the world. It is a bedroom door, not a safe.

The real issue: the shared device

In a household, the laptop is rarely personal. It moves between the desk, the kitchen and the coffee table, and several adults use it under the same system account. That is where every precaution taken in front of the camera collapses.

The answer is not repeated cleaning, it is separation. Three levels, from the lightest to the most robust:

1. A dedicated browser profile. Chrome, Firefox and Edge all let you create several profiles, each with its own history, cookies, passwords and extensions. Nothing leaks from one profile to another, and the profile can be given a neutral name.
2. A separate system user account. A second Windows or macOS account, protected by a different password, also isolates temporary files, logs and downloads.
3. A separate device. The cleanest solution if the budget allows: an entry-level tablet or an old laptop repurposed is enough, with no family account on it at all.

This logic of compartmentalisation — nickname, email, browser — is the subject of a full article on how to separate your digital life. The hardware complement, here, is the simplest of all: a sliding webcam cover stuck over the lens settles the question of unintended sessions in one gesture on a device that passes from hand to hand, and it is visible — therefore verifiable — by everyone sharing the home.

The notification trap

A notification that appears on a locked screen is read by the first person who walks past. Browsers ask for permission to send them, and plenty of adults click "Allow" out of reflex on a first visit.

Two settings are enough:

• refuse website notifications globally in the browser settings;
• in the system, hide the content of notifications on the lock screen (an option available on Windows, macOS, Android and iOS).

On a phone lying face up on the table, an adjustable phone stand that keeps the screen tilted towards you also prevents a preview from being legible to someone else in the room — a trivial detail that solves a frequent problem.

The ten-minute routine, once and for all

The classic mistake is to clean up after every session, at length, in a panic. That is ineffective and easy to forget. Far better to set things up once, in a way that makes cleaning almost unnecessary.

One detail that matters: if you use a password manager, the entry for the 18+ service appears in a list that anyone who unlocks the app can browse. An offline password manager, or simply a code-locked password notebook kept in a closed drawer, avoids exposing the full list of your accounts every time you look up a login in front of someone.

On the platform's side: what you cannot erase yourself

Cleaning your device deletes nothing of what the platform keeps. And that is normal: an 18+ service has legal obligations that require it to retain certain data, which no "delete my history" button will wipe.

• Connection data. In France, the implementing decree of the loi pour la confiance dans l'économie numérique (Act on Confidence in the Digital Economy) requires online service providers to retain certain technical data (IP address, timestamp) for one year, available to the judicial authorities.
• Moderation material. A report necessarily keeps a record of the exchange concerned, otherwise no decision could ever be verified. The mechanism is described in our article on how moderation actually works.
• Age verification evidence. Depending on the method used, the platform keeps either a simple "adult: yes" attribute or a token issued by a third party. The question of what happens to an ID document after a check is covered separately, in age verification: what happens to your ID.

In return, the GDPR gives you two concrete rights that few adults exercise: the right of access (Article 15), which lets you request a copy of the data held about you, and the right to erasure (Article 17), which applies to everything not covered by a legal retention obligation. The request is made in writing to the data protection officer listed in the legal notices; the CNIL (French data protection authority) provides freely reusable letter templates and states a response deadline of one month.

Deleting your account without leaving an orphan

Closing an 18+ account properly requires a specific order, otherwise a loose thread always remains:

1. remove the saved payment method and check that no subscription is active;
2. request account deletion through the interface provided, rather than simply abandoning the account;
3. delete the dedicated email address after deletion has been confirmed, never before — without it, you cannot receive the confirmation;
4. remove the entry from the password manager and the browser profile.

Step 3 is the one most often done out of order. A dedicated email address closed too early leaves an active account, impossible to recover, tied to a mailbox that no longer exists.

What this changes in practice

The overall picture is less intimidating than it looks. The traces on a device are numerous but inert: they are not going anywhere, they are simply waiting for someone close to you to find them. A dedicated browser profile, silent notifications and automatic clearing on close remove most of the risk, and the routine never has to be repeated.

The hierarchy of effort is clear: first separate (profile, system account, device), then reduce what gets written (private browsing, no saved passwords), and finally exercise your rights with the platform for what is no longer up to you. In that order, ten minutes is enough. In the other, you clean indefinitely a device that keeps recording everything.

One obvious point remains that technology does not cover: if the device is shared with a partner, the real protection is not a browser cache, it is a conversation. The subject is tackled head-on in our article on what happens when only one of the two wants to try.