Why a phone number counts as an identifier.
A phone number does not look like sensitive data the way a password or a photo does, but it functions as a genuine identifier under GDPR because it can be, and routinely is, used to link separate accounts and services back to the same person. A ride app, a food delivery service, a loyalty scheme and a messaging app can all end up tied to the exact same number without ever directly sharing data with each other in any formal sense.
That linking happens quietly, through the number itself rather than through any deliberate data sharing agreement. Anyone with access to that number, whether a marketing database, a data broker, or someone simply searching it, can potentially find several of those accounts connected to the same person, each one revealing a little more than the last.
None of this requires anything technically advanced on the other end either. A basic reverse lookup service, freely available online, is often enough to connect a number back to a name or a social profile, which is part of why a number handed out casually spreads further than most people assume, often into places its owner never anticipated it reaching.
Where this becomes a practical problem.
The clearest everyday example is contact discovery in messaging apps: a number saved in someone else's phone can surface a profile photo, a status, or a last seen indicator, sometimes to people who were never given the number directly but happened to have it synced from a shared contact list on their own device.
A number can also outlive the relationship it was originally shared for. Long after a reason for contact has passed, the number itself often remains saved somewhere, still capable of surfacing information about its owner to whoever kept it on file.
It also matters for anything meant to stay separate from an everyday identity. A single number used for both routine daily contact and for arranging something more private removes the separation that would otherwise keep the two neatly apart, no matter how careful either side of that conversation tries to be afterwards, since the number itself is the thread tying both contexts back together.
The most direct fix: a second number.
A second, dedicated number kept specifically for bookings, private contact or anything else meant to stay apart from a main line is the single most effective step here. Setting one up as an eSIM has become straightforward enough that our full guide to a second number walks through it directly from a phone's own settings, with no second physical SIM card needed at all.
Smaller habits that add up.
Beyond a second number, checking which apps and forms already have a number on file, and removing it from ones that no longer need it, closes off a surprising number of quiet links over time. A number given to a single delivery order five years ago rarely needs to still be sitting on file today.
Saving a contact without turning it into a permanent record on a shared device is the topic of our guide to saving contacts with privacy in mind, which touches on the same underlying identifier problem from the other direction, the number someone else has saved rather than the one you hand out yourself.
How this fits around a booking.
Arranging time with Michelle or an evening filed under curvy works the same way any discreet booking should: a number given to confirm plans for travel or an evening in Den Haag is used for exactly that purpose and nothing beyond it, which is precisely why a separate number for this kind of contact is worth having in the first place, before it ever gets asked for.
Porting and SIM swaps, a related risk.
Because a phone number is often used to reset a password or verify a login, it can become a target in its own right. A SIM swap, where someone convinces a carrier to move a number onto a new SIM they control, is a real if uncommon attack that turns a phone number into a key for resetting accounts that rely on it for verification.
A PIN or extra verification step set with the mobile carrier itself, where that option exists, adds a layer of protection against exactly this scenario, on top of everything else covered here about limiting who has the number in the first place.
Where a number sits alongside other identifiers.
A phone number rarely sits alone. Paired with an email address, it becomes considerably easier to connect accounts across services, which is why the same compartmentalising logic extends naturally to inboxes as well, detailed in our guide to email aliases. Treating both as a matched pair, rather than solving one and leaving the other unchanged, closes far more of the gap than either step manages alone.
The short version.
Treat a phone number the way you would any other identifying detail, worth giving out deliberately rather than by default. Before checking the booking page for the next arrangement, it is worth a moment's thought about which number is actually going to be used for it, and whether that choice still makes sense a year or two further on.