The mechanism is called a machine identification code, or MIC. It exists because of an arrangement between printer manufacturers and governments that dates back decades, and it survived from the analog era into yours with almost no public debate. Most people who own a color laser printer have never heard of it.
A Deal Made Over Counterfeiting
The original concern was currency. As color laser printers and copiers got good enough to reproduce banknotes in the 1980s and 1990s, manufacturers began cooperating with government agencies on countermeasures. One of those countermeasures was forensic: make every machine leave a fingerprint on its output, so that a counterfeit bill or document could be traced back to the specific printer that produced it. The United States Secret Service has acknowledged working with printer vendors on tracing technology, and Xerox engineers have discussed the dot system in public.
The trouble with a forensic fingerprint is that it does not check what you are printing. A counterfeit bill gets stamped with the printer's identity, and so does a leaked memo, a union flyer, a draft of a novel, and a letter to a lawyer. The capability built for one purpose applies to everything.
What the Dots Encode
In 2005, researchers at the Electronic Frontier Foundation decoded the pattern used by the Xerox DocuColor line. The dots repeat across the page in a 15 by 8 grid, and the grid encodes the date, the time to the minute, and the printer's serial number. Once you know the scheme, reading a page is mechanical: photograph it, isolate the yellow channel, and translate the dot positions into digits.
The DocuColor scheme was one vendor's implementation, not the whole story. In 2018, researchers at TU Dresden published a systematic analysis of dot patterns from printers across 18 manufacturers and identified four distinct encoding schemes. They also released a free toolkit, called deda, that can extract the dots from a scan, attempt to decode them, and, notably, anonymize a document by flooding it with extra dots so the real pattern is no longer recoverable.
Scan a color laser printout at 600 dpi, open the image in any editor, isolate the blue channel, and invert it. The yellow dots become dark and visible. A blue LED flashlight and a magnifier work directly on paper: yellow reflects poorly under blue light, so the dots appear as a dark grid.
The Document That Made It Real
In June 2017, The Intercept published a classified NSA report on Russian interference in US election infrastructure. The published PDF was a scan of a printed document, and the scan preserved the yellow dots. Security researchers decoded them within hours of publication: the page had been printed on May 9, 2017, at 6:20, on a printer with a readable serial number.
Reality Winner, the NSA contractor who leaked the report, was arrested before the story even ran. The FBI affidavit says she was identified through printer audit logs, which showed only six people had printed the document, not through the dots themselves. But the episode demonstrated the pipeline end to end: a physical page carries machine-identifying metadata, a scanner faithfully preserves it, and anyone with the published file can read it. A news organization handling source material had let a tracking code pass straight through to publication.
The lesson generalizes beyond leaking classified documents. Any situation where a printed page should not be traceable to a specific machine, at a specific time, is a situation where the dots matter. That covers whistleblowing, but also anonymous complaints to a regulator, sensitive material shared inside a company, and documents produced under repressive governments where owning the wrong printout is dangerous.
You Cannot Get a Clean List
For years, EFF maintained a public list of which printers did and did not produce visible dots. They stopped maintaining it, and their current guidance is blunt: assume every color laser printer embeds some form of tracking information, and note that some of it may not take the form of yellow dots at all. Forensic marks can be embedded in ways that are harder to spot, such as subtle modulation of how toner is laid down. The visible dot grid is the implementation we know about because researchers found it.
The safest assumption is that all modern color laser printers include some form of tracking, whether or not it is visible as yellow dots. Paraphrasing EFF's standing guidance since it retired its printer list
That means the dots belong in the same mental category as document metadata and writing style analysis: identifying signals that ride along with content you share, invisible unless you go looking, and routinely forgotten by people who carefully redacted everything else.
What Actually Helps
There is no setting to turn the dots off. The code is embedded in firmware, and manufacturers do not document it. The practical mitigations are upstream of the printer:
- Print in black and white on a monochrome laser printer. The dot system is a color-laser mechanism; a printer with no yellow toner cannot print yellow dots. This is the simplest reliable defense.
- Run scans through an anonymization tool. The TU Dresden deda toolkit can flood a page image with additional dots, destroying the recoverable pattern before you share the file.
- Convert shared scans to pure black and white. Aggressive thresholding to a 1-bit image discards the yellow channel entirely. Redaction workflows that end in grayscale at high contrast strip the dots as a side effect.
- Treat the purchase as linkable. The dots encode a serial number. A printer bought with a credit card, registered for warranty, or serviced under your name connects that serial to you. For high-stakes use, this matters as much as the dots themselves.
And if you handle documents from sources, learn the Intercept lesson: retype sensitive material rather than publishing scans. A retyped document sheds the dots, the paper texture, the fold marks, and the printer artifacts in one move. What survives is the text, which is the only thing you meant to share.
Why This Story Is Worth Knowing
The machine identification code is one of the clearest examples of a pattern that repeats across surveillance technology. A tracing capability was negotiated privately between industry and government, deployed to hundreds of millions of devices without disclosure, justified by a narrow crime, and applied indiscriminately to everyone. It took independent researchers to discover it, decode it, and tell the public. Nothing about the arrangement was illegal, and nothing about it was consented to.
Once you know the pattern, you start recognizing it elsewhere: in telecom identification systems, in device attestation, in the metadata that clings to everything digital. The dots are just the version you can see with a flashlight.