When you touch a surface, you leave behind fingerprints—distinctive swirling patterns of oils that reveal your identity. You might also deposit traces of DNA, which can also be used to identify you. And you leave microbes. You are constantly bleeding microbes into your surroundings, and whenever you touch something, bacteria hop across from your skin.

It’s increasingly clear that everyone has a unique community of microbes—or microbiome—living on their bodies. We share species and strains but the exact roll call varies from person to person. “If you take a collection of people, their microbes will look very different but their genomes will look mostly the same,” says Curtis Huttenhower from the Harvard School of Public Health. So, could the DNA of these tiny variable residents also reveal our identity, just like fingerprints or our own DNA?

A few studies have suggested so. In 2010, Noah Fierer from the University of Colorado found that bacteria swabbed from keyboards and mice matched those on their owners’ skins more closely than those from other people. (The match wasn’t quite accurate enough for forensic use, although that didn’t stop CSI Miami from running with it.) And last year, Simon Lax and Jack Gilbert from the University of Chicago managed to identify people, from a pool of 18 volunteers, based on the microbes they left behind in their homes.

More recently, Lax and fellow student Sean Gibbons spent two days swabbing their mobile phones, the soles of their shoes, and the floor around them, on an hourly basis, to many strange looks. They found that the shoes and phones retained traces of their owners, so that an algorithm could accurately identify whose items any given sample came from. The objects were also heavily influenced by their environment; the shoes, in particular, quickly picked up microbes from the floors they walked over, suggesting that it might be possible to track a person’s movements from the microbes on their belongings.

But what would happen if you scaled these studies up to larger populations? Could you still accurately pinpoint a person using their microbes, without false alarms? Would the results be consistent? And while fingerprints and genomes are largely constant, microbiomes change a lot—so will a person’s abandoned microbes still identify them weeks or months later?

To answer these questions, Eric Franzosa and other members of Huttenhower’s team worked with data from the Human Microbiome Project, which collected microbes from the guts, skin, and other body sites of 120 people, at several points in time. They used an algorithm that took data from each volunteer’s first visit, extracted features like the presence of certain species, strains, or genes, and combined the most distinctive ones into a “code” that was unique to each individual, but also consistent over time. They then compared these codes to samples collected several months later to see if they could still identify the right owners.

They only managed to recognise a third of their volunteers in this way. That’s nothing to sniff at, but it certainly doesn’t match the forensic utility of the human genome, or even fingerprints. The results were more promising when the team focused on gut microbes, which proved to be exceptionally stable; gut-based codes identified 86 percent of the volunteers.

“That’s a floor. The accuracy can only go up if we have more sequencing data and better algorithms,” says Huttenhower. He also notes that “since the microbiome changes over time, we wanted to get as few things wrong as possible, so we biased the algorithm in favour of false negatives.” That is, the program might fail to identify people based on their microbes, but it will almost never identify the wrong person.

Their results reflect our growing understanding of the human microbiome. Our bodies—and our guts, in particular—are colonised by a surprisingly stable set of bacterial strains. Their levels might fluctuate, but the same coterie persists for decades. Perhaps our genes or our immune systems determine who gets to stay. Perhaps there’s a “first-mover advantage”, where the first strains to set up shop then dictate which others get to immigrate. Either way, as Huttenhower says, “Not only are we robots for microbes, but each of us is a robot for a specific set of clones or strains that ride around with us for a long period of time.”

He doubts that these results are important for forensic science. “If you deposit your microbes, you’re probably depositing your DNA too and DNA forensics is so well developed,” he says. But he adds that microbiome researchers need to be wary of these issues to protect the privacy of study volunteers. The data from such studies is always anonymised, but if people have unique and consistent signatures, there’s a risk that information from different data sets could be compared in ways that break anonymity.

Consider what happened with Netflix. In 2007, the online media company released movie rankings from 500,000 of its customers, so that others could help to improve its recommendation algorithms. Even though the data were anonymised, researchers still managed to identify some of the individuals by comparing their rankings to non-anonymous profiles from IMDB, another movie site. And unlike movie rankings, our microbiome could reveal potentially sensitive information about what we eat, and whether we suffer from health problems.

“This isn’t an issue now and it’s not a high-risk issue, but it’s still important for us to consider,” says Huttenhower. “No one study has any danger of releasing private information but due to uniqueness, the ability to link across studies becomes a possibility.”

Reference: Franzosa, Huang, Meadow, Gevers, Lemon, Bohannan & Huttenhower. 2015. Identifying personal microbiomes using metagenomic codes. PNAS http://dx.doi.org/10.1073/pnas.1423854112